NextPKI Sensor

Finds TLS certificates on your own network and reports them to NextPKI.

Install

curl -fsSL https://sensor.nextpki.com/latest/install.sh | sh

Look inside first

Sensible. Download it, read it, then run it:

curl -fsSL https://sensor.nextpki.com/latest/install.sh -o install.sh
less install.sh
sh install.sh

Verify the signature yourself

Every release is signed with an ed25519 key whose private half is neither on this host nor in the source code. Verification uses ssh-keygen, which is present on every Linux and every Mac:

curl -fsSLO https://sensor.nextpki.com/latest/SHA256SUMS
curl -fsSLO https://sensor.nextpki.com/latest/SHA256SUMS.sig
curl -fsSL  https://sensor.nextpki.com/latest/release-key.pub \
  | sed 's/^/nextpki-sensor-release /' > allowed_signers

ssh-keygen -Y verify -f allowed_signers -I nextpki-sensor-release \
  -n file -s SHA256SUMS.sig < SHA256SUMS

Fingerprint of the release key:

SHA256:+6znvJRuTIkoE47Bdt2fgWqp/DRfwAgjlyZrYDSJtvs

Files

/latest/ points at the current version. If you want a specific one, name it in the path: /0.1.0/.